Windows sysinternals

Process Monitor (Procmon)
451
ProcDump (continued)
64-bit dump files, 233
thread CPU usage data, 233
thread stack dumps, 422
triggers for dumps, 231–232
viewing dump files, 236–237
process activity
capturing, 104
saving snapshot of, 65
summary of, 134–135
viewing, 39–65, 102. See
also Process Monitor
(Procmon)
Process Activity Summary
dialog box, 134–135
process and diagnostic utilities,
4
Process Disk tab, 63–64
process dump files, 53, 227–237
comments in, 236
commit charges, triggering
with, 232
criteria for, 230–232
DebugView analysis, 242
default thread context, 237
names of, 230
overwriting, 230
path, 229–230, 236
performance counters
triggers, 232
64-bit dumps, 233
unhandled exceptions and,
231
Process Explorer (Procexp), 4, 39
administrative rights for,
42–43, 55, 58
call-stack analysis features,
405–426
command-line options, 98
Configure Symbols dialog
box, 29
CPU usage, 23, 41–42
default configuration settings,
restoring, 98
display options, 95–96
DLL view, 40, 67–77
executable images, full path
of, 432
graphs on toolbar, 65
Handle view, 34, 40, 67–77
image signatures, verifying,
91–92
instances of, 95–96
keyboard shortcuts, 98–99
main window, 40, 43–67
notification area icon, 95
open handles, finding, 384
other user sessions, 97
overview of, 39–43
process activity, saving to text
file, 65
process details, 77–88
process handle table, 74
process list, 40–41, 43–53
processes, creating in, 97
Session column, enabling, 182
shutdown options, 97
status bar, 43, 67
system information, 92–95
vs. Task Manager, 96–97
thread details, 89–91
toolbar, 43, 65–66
updating display, 46
visible window ownership,
displaying, 66–67
x86, x64, and IA64 versions,
40
process handle table, 74
process IDs (PIDs), 21
analyzing processes by, 226
listing processes by, 190
suspending processes by, 206
terminating processes by, 189
Process Image tab, 54–55
Process I/O tab, 61–62
process-killing malware,
429–431
process list, 43–53
color highlighting, 44–45
column configuration, saving,
64–65
columns, customizing display,
53
columns, reordering, 47
columns, resizing, 47
columns, sorting, 47
content, copying, 47
default columns, 46
exited processes, 45
job objects, 51
jobs, 44
logon processes, 49–51
.NET processes, 44
new processes, 45
own processes, 44
packed images, 44
precedence order, 44
process actions, 51–54
Process column, 46, 47
running processes in, 43
services, 44
startup processes, 49–51
suspended processes, 44
system processes, 48
tooltips, 48
tree view, 47
updating display, 46
user processes, 51
Process Memory tab, 57–59
Process menu, 51–53
Process Monitor (Procmon), 4,
101–144
administrative rights for, 102,
126
advanced output, 120
analysis tools, 134–140
Autoscroll feature, 103
backing files, 130–131
boot logging, 127–128, 402–
403, 434
buffer overflow results,
105–107
call-stack analysis features,
405–426
call stack information, 27–28
child processes, searching for,
387
clearing events, 103
column display, customizing,
107–108
column set, default, 104–105
command-line options,
132–134
configuration settings,
importing and exporting,
131
Count Values Occurrences
dialog box, 140
Cross Reference Summary
dialog box, 140
www.it-ebooks.info